Notice of Privacy Practices

Applicability of Notice

The Notice of Privacy Practices (“Notice”) describes the privacy practices of CHI St. Joseph Health and its Affiliated Facilities/Entities. For the purpose of this Notice, the terms “CHI St. Joseph Health”, “we”, and “our” refer to CHI St. Joseph Health and its Affiliated Facilities/Entities with reference to health information generated or maintained at each facility. The information in this Notice will be followed by our health care professionals who treat you at our facilities; team members and volunteers of our organization; Business Associates or subcontractors; and any affiliate or partner of CHI St. Joseph Health with whom we share health information. The effective date of this Notice is September 23, 2013.

Privacy Obligations

CHI St. Joseph Health is required by law to maintain the privacy of your health information, commonly referred to as Protected Health Information (PHI), and to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and abide by the terms of the Notice currently in effect. We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for medical information we already have about you, as well as, any information we receive in the future. We will post a copy of the current Notice in each of the Affiliated Facilities/Entities. The Notice will contain the effective date. A copy of the current Notice will be made available to you when you initially register with an Affiliated Facility/Entity for treatment or services, upon your request and on subsequent visits if the Notice has been revised.

Our Pledge
We understand that all information about you and your health is personal. We are committed to protecting this information. When you receive services at a CHI St. Joseph Health Facility/Entity, a medical record is created. This record describes the services provided to you and is needed to provide you with quality care and to comply with certain legal requirements. This Notice applies to records of your care generated by CHI St. Joseph Health, whether made by a CHI St. Joseph Health employee or a physician involved in your care. Physicians may have different policies regarding medical information created in their office. This Notice tells you about the ways in which we may use and disclose your medical information. It also describes your rights and certain obligations we have regarding the use and disclosure of your medical information. We will not sell your medical and personal information for direct or indirect payment without your authorization. If you have any questions, you may contact our Corporate Compliance and Privacy Officer, 2801 Franciscan Drive, Bryan, Texas, 77802, (979)776-5316.

How We May Use and Disclose Your Health Information
The following information describes how we are permitted, or required by law, to use and disclose your Protected Health Information:

Permissible Uses and Disclosures Without Your Written Authorization
In certain situations, which are described below, your written authorization must be obtained in order to use and/or disclose your PHI. However, St. Joseph does not need an authorization from you for the following uses and disclosures:

Uses and Disclosures for Treatment, Payment and Health Care Operations: Your PHI may be used to treat you, to obtain payment for services provided to you, and to conduct “health care operations” as described below:

Treatment: Your PHI may be used and disclosed to provide treatment and other services to you – for example to diagnose and treat your injury or illness. In addition, you may be contacted for appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. Your PHI may also be disclosed to physicians, organizations or individuals outside of CHI St. Joseph Health but who are also part of your health care team.

Payment: Your PHI may be used and disclosed to your insurance company or other third party to collect payment for services. For example, we may need to give your health plan information about surgery you received while here so that they will pay us or reimburse you. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment. Note: If you pay out-of-pocket, in full, for the care or service provided, you have the right to ask us to restrict the disclosure of that information to your insurance company.

Health Care Operations: Your PHI may be used and disclosed in connection with supporting our health care operations, such as, comparing patient data to improve treatment methods. We may also disclose this information to doctors, nurses, technicians, health care students, or management for review and learning purposes, and to business associates who perform treatment, payment and health care operations on behalf of CHI St. Joseph Health.

Sharing Information with Another Organization: Your PHI may also be shared with another organization if 1) it is involved or may be involved in your care; 2) it is or may be involved in the payment of your care; or 3) such organization already has relations with you and the information shared will help both our organizations to conduct quality assurance activities, population-based activities, case management, care coordination, training, accreditation, licensing or credentialing, or for health care fraud and abuse detection or compliance. We may, for example 1) share your information with several home health agencies as we attempt to identify the best one for you; or 2) share your information with companies that will assist us in obtaining payment; or 3) share your information with an organization that will assist us in measuring and improving our quality of care.

Use and Disclosure for Directory of Individuals in the Hospital: CHI St. Joseph Health may include your name, location in the hospital, general health condition (e.g. fair, stable, etc.) and religious affiliation in a patient directory without obtaining your authorization unless you object to inclusion in the directory. This information, except for your religious affiliation, may also be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, even if they don’t ask for you by name. This is so your family, friends and clergy can visit you in the facility and generally know how you are doing.

Disclosure to Relatives and Close Friends: Your PHI may be disclosed to a family member, friend or other person to the extent necessary to help with your health care or with payment for your health care. We may use or disclose your name, hospital location, and general condition or death to notify, or assist in the notification of (including identifying or locating) a person involved in your care. We may also disclose your medical information to whomever you give us permission. Before we disclose your medical information to a person involved in your health care or payment for your health care, we will provide you with an opportunity to object to such uses or disclosures. If you are not present, or in the event of your incapacity or an emergency, we will disclose your medical information based on our professional judgment of whether the disclosure would be in your best interest. We will also use our professional judgment and our experience with common practice to allow a person to pick up filled prescriptions, medical supplies or other similar forms of medical information.

Disaster Relief: Your PHI may be used or disclosed to a public or private entity authorized by law or by its charter to assist in disaster relief efforts.

Research: Under certain circumstances, we may use and disclose medical information about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another, for the same condition. All research projects are subject to special approval by the Institutional Review Board. We may disclose medical information about you to people preparing to conduct a research project so long as this information does not leave St. Joseph. For example, a prospective researcher may want to look at patients with specific medical needs. If the research involves anything more than a review of your medical information, we will contact you in order to obtain your authorization or its further use will be subject to your authorization. Some research involves a review of medical care only (record review). In this research, the risk of physical harm or injury to the patient is small and the need for an informed consent from the patient is waived. Research involving a record review must be approved by the Institutional Review Board. If approved, the Ethics Committee will also review the proposed research to ensure the privacy interests of the patients are protected.

Fundraising Activities: CHI St. Joseph Health may use or disclose health information about you and contact you in an effort to raise money for our organization and its operations. We may disclose this information to the St. Joseph Foundation to assist us in our fundraising activities. Only contact information such as your name, address and telephone number, and the dates you received treatment or services at CHI St. Joseph Health would be released. You have the right to opt-out of fundraising communications at any time and your request must be honored. If you would like to opt-out of receiving future fundraising communications, please call (877) 367- 5681 to make your opt-out request.

As Required by Law: We will disclose medical information about you when required to do so by federal, state or local law.

Public Health Activities:
Your PHI may be disclosed as authorized by law for public health activities. These activities generally include providing information to/for:

Disease and vital statistics reporting, child abuse reporting, adult protective services and FDA oversight Employers regarding work-related illness or injury

Cancer, Trauma and Birth Registries

Health Oversight Agencies (for such things as audits, inspections, and licensure) Responding to court and administrative orders and for other lawful processes

Requests from law enforcement officials pursuant to subpoenas and other lawful processes, concerning crime victims, suspicious deaths, crimes on our premises, reporting crimes in emergencies, and for purposes of identifying or locating a suspect or other person

Coroners, medical examiners and funeral directors Organ procurement organizations

Avert a serious threat to health or safety Correctional institutions regarding inmates

As authorized by state worker’s compensation laws

To the military, to federal officials for lawful intelligence, counterintelligence, and national security activities, and to correctional institutions and law enforcement regarding persons in lawful custody

Uses and Disclosures Requiring Your Written Authorization

Use or Disclosure with Your Authorization: For any purpose other than the ones described above, your PHI may be used or disclosed only when you provide your written authorization on an approved authorization form (“Authorization to Disclose Information”). For example, you will need to execute an authorization form before your PHI can be sent to your life insurance company or to the attorney representing the other party to litigation in which you are involved.

Marketing: We will not use your medical information for marketing purposes without your authorization. If you have consented to receive marketing information but no longer wish to receive further information, please call (877) 367-5681 to make your opt-out request.

Special Privacy Protections for Alcohol and Drug Abuse Information: Alcohol and drug abuse information has special privacy protections. We will not disclose any information identifying an individual as being a patient or provide any health information relating to the patient’s substance abuse treatment unless the patient consents in writing; a court order requires disclosure of the information; medical personnel need the information to meet a medical emergency; qualified personnel use the information for the purpose of conducting scientific research, management audits, financial audits, or program evaluation; or it is necessary to report a crime or a threat to commit a crime, or to report abuse or neglect as required by law.

Your Rights Regarding Health Information About You

Right to Inspect and Copy: You have the right to inspect and copy information in your medical record. This right does not extend to any psychotherapy notes. To inspect and/or get a copy of your medical record you must submit your request in writing to the Medical Records department at the applicable Affiliated Facility/ Entity. You may be required to pay copying costs. You may request this information in a printed format, or if the information is maintained electronically you may request an electronic copy of the information.

Right to Amend: If you believe that information in your designated record set is incorrect or that information is missing, you have the right to request that we correct the records. Your request must be submitted to the Medical Records department, in writing, and include the reason you are requesting the change. We can deny your request to change a record if the information you are requesting to be changed was not created by us, is not part of the medical or billing information maintained by us, or if we determine that the record is accurate.

Right to Request Restrictions: You have the right to request a limit on medical information we disclose to someone who is involved in your care or the payment of your care, such as, a family member or friend. For example, you could ask that we not disclose information about a surgery you had. To request restrictions, the request must be made in writing to the Medical Records department at the applicable Affiliated Facility/Entity. We are not required to agree to your request. If we do agree, we will comply with your restrictions unless the information is needed to provide emergency treatment.

Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests. To request restrictions, the request must be made in writing to the Medical Records department at the applicable Affiliated Facility/Entity.

Right to Revoke your Authorization: If you provide us with authorization to use or disclose medical information about you, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. We are unable to take back any disclosures we have already made with your permission and we are required to retain our records of the care that we provided to you. A form of written revocation is available upon request from the Affiliated Facility/ Entity’s Medical Records department.

Right to a Paper Copy of this Notice: If you view this Notice on our Web site or by electronic mail (e-mail), you are entitled to receive a copy of this Notice in written form. Please contact us as directed below to obtain this Notice in written form.

Breach Notification: In the event that we, one of our Business Associates, or subcontractors discover an inappropriate use or disclosure of your health information, you will receive a notification of breach of your unsecured PHI.

Disposal of Medical Records: You have the right to know that your medical records may be destroyed ten (10) years after you were last treated in the hospital, or until the patient’s 21st birthday, whichever is later. St. Joseph may not destroy medical records that relate to any matter that is involved in litigation, if CHI St. Joseph Health knows the litigation has not been fully resolved. Such records may be destroyed upon final resolution of the litigation.

Right to an Accounting of Disclosures: You have the right to a list of those instances when we have disclosed medical, billing and personal information about you, for reasons other than treatment, payment, or health care operations without your authorization. Your written request must identify a time period, which must be less than a six (6) year time period and after April 14, 2003. You may receive the list in a printed format, or if available, in an electronic format. There may be a cost associated with your request. You will be informed of the cost before any charges are incurred.

Safeguards

CHI St. Joseph Health safeguards customer information using various tools such as firewalls, passwords and data encryption. We continually strive to improve these tools to meet or exceed industry standards. We also limit access to your information to protect against its unauthorized use. The only St. Joseph workforce members who have access to your information are those who need it as part of their job. These safeguards help us meet both federal and state requirements to protect your personal health information.

CHI St. Joseph Health Compliance and Privacy Office: If you would like more information about our privacy practices or have questions or concerns about this Notice, please contact the Compliance and Privacy Office at the number listed below. If you believe your privacy rights have been violated, you may file a complaint, in writing, to the St. Joseph Health System Compliance and Privacy Office located at:

2801 Franciscan Drive, Bryan, Texas 77802

Or, by calling (979)776-5316, or you may contact the U.S. Department of Health and Human Services (DHHS) at:

1301 Young Street, Suite 1169

Dallas, TX 75202

Phone: (800) 368-1019

FAX: (214) 767-0432

TDD: (800) 537-7697

To e-mail the DHHS Secretary or other Department Officials, send your message to OCRMail@hhs.gov